Money misappropriated from Malaysian state fund 1MDB was moved to the U.S. via law firms’ pooled accounts and used to buy and flip a condo, according to U.S. Department of Justice lawsuits. Here is how the DOJ said the money flowed.

The result is “a way of getting money into the U.S. system without going through the anti-money-laundering safeguards,” said Elise Bean, former chief counsel to a Senate investigating subcommittee that analyzed vulnerabilities in the banking system. It’s “a pretty darn big loophole.”

The Financial Action Task Force, a global group that sets international standards for anti-money-laundering procedures, has called the law-firm accounts a vulnerability. In a December report assessing American efforts to fight financial crime, the group criticized the U.S.’s limited oversight of lawyers, who are not required to flag suspicious financial activity.

American Bar Association President Linda A. Klein said the ABA supports the legal profession’s efforts to prevent misconduct involving client money. “Additional financial reporting requirements would be unnecessary and burdensome,” she said, because there are few examples of client trust accounts being misused.

Ms. Klein said the ABA has supported guidance to alert lawyers to suspicious situations and will continue supporting reasonable efforts to fight money laundering “in ways that minimize the impact on the attorney-client privilege” and clients’ right to effective counsel.

Most pooled accounts aren’t the law firms’ idea. Many state courts or legislatures mandate that lawyers combine small sums of client money and funds held only briefly, as a way to generate interest to fund legal aid to the poor. Most such accounts are called IOLTAs, for Interest On Lawyer Trust Accounts. Law firms hold certain other client money in individual clients’ names.

The pooled accounts typically contain money held for real-estate purchases, pending lawsuit settlements and prepaid legal services, but they can contain client money that a firm is holding for virtually any purpose, said Nabil Foster, a partner at Hinshaw & Culbertson LLP in Chicago.

Hundreds of millions of dollars allegedly siphoned out of 1Malaysia Development Bhd., the Malaysian state fund known as 1MDB, passed through law-firm pooled accounts in the U.S., federal prosecutors said in lawsuits filed in July. Investigators in several countries say billions of dollars are missing from the Malaysian fund.

The Justice Department, in civil suits seeking forfeiture of assets allegedly bought with stolen 1MDB money, said law firms holding the money in their pooled accounts authorized transfers that were used to pay for luxury U.S. real estate, jewelry, and yacht and jet rentals.

Other transfers moved money from a pooled account to Las Vegas casinos and to personal bank accounts of individuals linked to the global 1MDB scandal, according to the lawsuits.

In one set of transactions, the Justice Department lawsuits said, Malaysian financier Jho Low, whom investigators consider a central figure in the alleged 1MDB fraud, wired $148 million from a Swiss bank account to law firm Shearman & Sterling LLP’s pooled account at Citibank in New York in October 2009.

Four months later, four bank checks totaling about $22 million were issued from the law-firm account to pay for a condo in the Park Laurel adjacent to Manhattan’s Central Park, the suits said. The buyer was listed as a British Virgin Islands firm called Park Laurel (NYC) Ltd.

That company sold the condo a couple of years later to an entity called Park Laurel Acquisition LLC. The lawsuits said that entity was controlled by Riza Aziz, the stepson of Malaysian Prime Minister Najib Razak.

About $34 million for this second purchase of the condo was transferred to the Shearman & Sterling pooled account, according to the lawsuits.

They said the money came from a Singapore account held by a British Virgin Islands firm that Mr. Aziz controlled.

Next, a wire from the Shearman & Sterling pooled account sent a similar amount of money to an attorney trust account of another law firm, Sullivan & Cromwell LLP.

The Sullivan & Cromwell account, also held at Citibank, then wired $34 million to a bank account at Switzerland-based Rothschild Bank AG to pay Mr. Low, said the suits.

The Justice Department suits asserted that the cash for both purchases of the condo was stolen from 1MDB. The suits said companies controlled by Mr. Low and Mr. Aziz sent a total of $489 million into Shearman & Sterling’s pooled account from overseas.

The asset-seizure suits are civil actions filed against properties themselves, and don’t include any individuals as defendants.

Messrs. Low and Aziz both have denied any wrongdoing in the 1MDB matter.

Neither Citibank nor the U.S. law firms are accused of any wrongdoing. A spokeswoman for Shearman & Sterling said it was in compliance with legal and ethical standards and had no reason to believe funds might have been stolen. Citibank and Sullivan & Cromwell had no comment.

The predominant type of pooled client account traces back more than three decades to a cutback in federal spending on civil legal aid, said Randall Berg, a Florida public-interest attorney who helped set up pooled-account systems in several states to generate interest to pay for civil legal aid. Today, 46 states and the District of Columbia require law firms to use such accounts.

A rough estimate of how much money runs through them is possible from the amount of interest they generate, which was $78 million in 2015, according to an ABA information repository. In five large states that track data on the accounts, banks paid an average interest rate of 0.21% on them. Those figures suggest that nationally, law firms’ pooled accounts held an average balance of at least $36 billion over the course of the year.

Since money often stays in them for only days or weeks, however, the amount flowing through in a year could be much higher. The figures suggest that if money sat in the accounts for an average of three months, roughly $146 billion would pass through in a year, and if money turned over every month, the total passing through would exceed $400 billion.

The accounts appear to be swelling. In the five large states that track balances — California, New York, Texas, Florida and New Jersey — the law firms’ pooled accounts collectively held roughly $20 billion last year, which was up 32% from 2012. The growth is partly due to higher sales of real estate, including luxury properties, some lawyers say.

The confidentiality of bank accounts in general became a bigger issue after the Sept. 11, 2001, terrorist attacks, when the government increased surveillance of the financial system. The legal industry fought hard to avoid being swept up in the extension of tough anti-money-laundering rules beyond bankers to other professions.

Stephen Saltzburg, a George Washington University law-school professor and member of the ABA policy-making body, called the prospect of rules requiring lawyers to turn in clients “the single most alarming threat to attorney-client privilege anyone has seen in a long time.” He led the passage of an ABA resolution against them.

This year, the ABA successfully pushed for pooled trust accounts to be exempt from new federal rules requiring financial institutions to know the beneficial owners of accounts that are in the names of legal entities such as shell companies. People can effectively get around those requirements by sending money to their lawyers’ accounts for short periods, said Richard Gordon, a Case Western Reserve University law professor and former anti-money-laundering specialist at the International Monetary Fund.

American lawyers do face rules requiring them to keep records of client funds and forbidding them to knowingly aid illegal conduct. Investigators can ask law firms to turn over pooled-account records in connection with a case. The ABA has voluntary guidelines for lawyers to spot and prevent money laundering.

Lawyers in the U.S. don’t have to investigate client conduct unless they believe a client may be engaging in illegal activity while using the lawyer’s services, unlike requirements in other developed countries. In situations where a U.S. lawyer learns a client is engaging in nefarious activity, state rules vary on whether the lawyer would be required to report it to the government, said Hal Lieberman, a New York legal-ethics attorney.

Other attorneys said if the lawyers couldn’t persuade such a client to adhere to the law or end the possibly illegal activity, they should stop representing the client or risk being seen as facilitating the illegal activity.

Banks have occasionally faced sanctions for failing to detect money laundering carried out via pooled law-firm accounts. In 2009, investigators uncovered a $1.2 billion Ponzi scheme run by a South Florida attorney, Scott Rothstein, who had done transactions through his law firm’s pooled accounts at the U.S. unit of Canada’s Toronto-Dominion Bank and at Gibraltar Private Bank & Trust, a small Florida bank. Mr. Rothstein pleaded guilty to federal crimes including conspiracy to commit money laundering.

TD Bank and Gibraltar were fined a total of $56.5 million for failing to have sufficient controls in place to detect and report the scheme, along with other lapses. Both banks declined to comment.

In another case, for years banks and regulators were suspicious of accounts opened by Teodoro Nguema Obiang Mangue, vice president of Equatorial Guinea and son of the African country’s president. According to a U.S. Senate report, Mr. Obiang, often with the help of a lawyer, moved more than $100 million into the U.S. and deposited some of it in bank accounts used to pay for parking tickets, furnishings and other expenses. Investigators said they believed some of the funds were the proceeds of foreign corruption.

Some banks shut accounts linked to Mr. Obiang following internal reviews, but he continued sending money to his lawyer’s client trust account at Bank of America Corp., which had already closed Mr. Obiang’s accounts. In 2008, Senate investigators contacted Bank of America with concerns about the law-firm account, and it too was shut down, according to the Senate report.

Investigators at Bank of America had suspicions about the account but “made a judgment call” to keep it open because they believed the lawyer was using it to represent a client, a senior bank compliance officer told federal lawmakers in 2010, though he said the bank’s compliance procedures had since improved. Bank of America declined to comment.